code wiki / _hdl_build / nx_secret_rotation_register.nx
nx_secret_rotation_register.nx source
↩ module page · 42 lines · 3899 B
1// nx_secret_rotation_register.nx -- registers the SECRET ROTATION + CSPRNG + random-iv-vault
2// organ via the Librarian. ENGINEER evidence = entropy gate + vault-v3 gate + pw-rotate gate,
3// ALL re-run here (no stale grades); on pass dual-writes the capability via cl_next_idx.
4// license_tier: ORIGINAL
5import "nx_cap_register.nx"
6import "nx_capreg_librarian.nx"
7import "nx_syscalls.nx"
8
9func srr_run(path: *u8) -> i64 {
10 let pid: i64 = sys_fork()
11 if pid == 0 {
12 let dn: i64 = sys_openat_wr("/dev/null" as *u8, 0x1a4)
13 if dn >= 0 { sys_dup3(dn, 1, 0); sys_dup3(dn, 2, 0) }
14 let argv: *i64 = sys_mmap(32) as *i64; argv[0] = path as i64; argv[1] = 0
15 let envp: *i64 = sys_mmap(16) as *i64; envp[0] = 0
16 sys_execve(path, argv, envp); sys_exit(127)
17 }
18 let st: *i64 = sys_mmap(16) as *i64
19 sys_wait4(pid, st, 0)
20 return st[0]
21}
22
23func main() -> i64 {
24 var allok: i64 = 1
25 if srr_run("_offc/nx_entropy_gate.elf" as *u8) != 0 { allok = 0 }
26 if srr_run("_offc/nx_vault_v3_gate.elf" as *u8) != 0 { allok = 0 }
27 if srr_run("_offc/nx_pw_rotate_gate.elf" as *u8) != 0 { allok = 0 }
28 cr_w(1, "ENGINEER: entropy(5) + vault_v3(5) + pw_rotate(5) gates pass=" as *u8); cr_wn(1, allok); cr_w(1, "\n" as *u8)
29 let eng: i64 = ig_engineer(1, 1, 1, allok)
30 let dec: i64 = ig_decision(eng, ig_council(eng, 1, 1, 2), 1)
31 if dec != IG_INGEST { cr_w(1, "HELD\n" as *u8); sys_exit(1) }
32 if cr_can_register(5, 2, 6, dec) != 1 { cr_w(1, "REFUSED\n" as *u8); sys_exit(1) }
33 let lp: *u8 = "/tmp/nishi_cap_registry.log" as *u8
34 let jp: *u8 = "knowledge/status/cap_registry_durable.log" as *u8
35 let idx: i64 = cl_next_idx(lp, jp)
36 let ok: i64 = cl_register_dual(lp, jp, idx, 5,
37 2, "GEN SECRET ROTATION organ (security arc rung 4 = the TRUE closure of the plaintext-pw debt: migration protects a value going forward, but a value that ever sat in plaintext/transcripts must be CHANGED). Three sovereign modules, all team-built hardware-up: (1) nx_entropy = kernel CSPRNG organ, getrandom(2) x86 syscall 318 DIRECT (frozen kg table lacks the row), ent_fill fails-CLOSED (never weak fallback) + ent_pw 64-char uniform alphabet (6-bit index, ZERO modulo bias; 24 chars=144 bits) -- gate 5/5 incl monobit smoke (ones~49.7%). (2) nx_vault v3 = random salt+iv EMBEDDED in the seal ([magic 2][ver 1][pad 5][ptlen 8][salt 12][iv 12][ct][tag 16]), AAD nishi-vault-v3, seal fails-closed without entropy; open dispatches on the version byte so legacy v2 (path-derived iv) still reads -- the v2 path-derived iv was an AES-GCM NONCE-REUSE break the instant a path is re-sealed with a new value, which is exactly rotation; gate 5/5 incl K2 re-seal-distinct-ciphertext (the rotation-safety property) + tamper-fails-closed + legacy-v2-opens + LIVE nas get; bak _offc/nx_vault.elf.bak-pre-v3-20260610. (3) nx_pw_rotate = rollback-safe self-verifying rotation: machine-key derive -> PROVE current open -> backup .nv -> CSPRNG new value -> v3 reseal -> VERIFY byte-exact (mismatch RESTORES backup, old secret never lost) -> new value to /tmp/nxnewpw 0600 for the operator's live-service push (a tool must never silently change a credential a human also logs in with); gate 5/5 on a THROWAWAY secret (nas.nv never touched, mtime-proven) incl K4 backup-decodes-to-old-seed + K5 re-rotate-distinct. entropy+vault_v3 gates wired as Conductor pulse steps (15/15); pw_rotate gate registered + on-demand (argon2id x4 too heavy per-beat). OPEN: operator pushes rotated nas pw to the Synology account then re-seals nas via rotate (held -- it is also the human login). Composes vault KDF v2 arc CAPREG326 + commit 3cdeaca4" as *u8)
38 if ok != 1 { cr_w(1, "DUAL-WRITE FAILED\n" as *u8); sys_exit(1) }
39 cr_w(1, "CAPREG idx=" as *u8); cr_wn(1, idx); cr_w(1, " REGISTERED (secret rotation + CSPRNG + random-iv vault)\n" as *u8)
40 sys_exit(0)
41 return 0
42}